JP2024502944A - Systems and methods related to applied anomaly detection and contact center computing environments - Google Patents

Abstract

According to one embodiment, a system for detecting anomalies in metric data provided by one or more customers, the system comprising: at least one processor; at least one memory including a plurality of stored instructions; The instructions, in response to execution by the at least one processor, cause the system to receive metric data indicative of a plurality of time-series-based observations for a particular customer metric, each of which represents a particular customer metric based on the metric data. define a plurality of parameters to characterize one or more spheres configured to capture several time-series-based observations about the one or more spheres; a system that generates and determines coverage of metric data within one or more spheres and detects one or more anomalies in the metric data. [Selection diagram] Figure 1

Description

(Cross reference to related applications)
This application claims priority to U.S. Provisional Patent Application No. 63/128,277, filed on December 21, 2020, the contents of which are incorporated herein by reference in their entirety. incorporated into the book.

Data analysis may include detecting anomalies in various data sets. In some cases, anomaly detection may involve evaluating whether a new observation belongs to the same distribution as a previous observation or should be classified as an outlier. Various systems and methods for anomaly detection have several drawbacks. Therefore, the development of alternative systems and methods for anomaly detection remains an area of interest.

One embodiment is directed to a unique system, component, and method for detecting anomalies in metric data provided by one or more customers. Other embodiments are directed to apparatus, systems, devices, hardware, methods, and combinations thereof for detecting anomalies in data provided by one or more customers.

According to one embodiment, a system for detecting anomalies in metric data provided by one or more customers includes at least one processor and at least one memory including a plurality of stored instructions, the instructions being , causes the system to receive metric data indicative of a plurality of time-series-based observations for a particular customer metric, each of which represents a particular customer metric based on the metric data. Define multiple parameters to characterize one or more spheres configured to capture several time-series-based observations, and generate one or more spheres based on the multiple parameters. and a memory for determining coverage of metric data within one or more spheres and detecting one or more anomalies in the metric data. Generating one or more spheres based on multiple parameters dynamically generates multiple spheres, each with a radius that changes based on multiple time series-based observations for a particular customer metric. may include doing.

In some embodiments, defining a plurality of parameters based on metric data includes defining a minimum radius for generating at least one sphere and generating one or more new spheres, each with a varying radius. The method may include defining a radius increment for generating the sphere and defining a coverage limit indicating a maximum number of metric data points covered by the generated sphere.

In some embodiments, generating one or more spheres based on the plurality of parameters may include determining a location corresponding to a maximum concentration of metric data based on a minimum radius.

In some embodiments, generating the one or more spheres based on the plurality of parameters includes determining whether a coverage limit has been reached and, in response to determining that the coverage limit has not been reached, determining the radius of the sphere. incrementing the radius to generate at least one new sphere based on the increment.

In some embodiments, generating one or more spheres based on the plurality of parameters includes determining whether at least one new sphere provides coverage of metric data not previously provided. and filtering out metric data already covered by the previous sphere in response to the determination that the at least one new sphere does not provide coverage of metric data not previously provided.

In some embodiments, generating one or more spheres based on the plurality of parameters includes determining that at least one new sphere provides coverage of metric data not previously provided. The method may include updating the radius and updating the position in response to a determination that the at least one new sphere provides coverage of metric data not previously provided.

In some embodiments, generating the one or more spheres based on the plurality of parameters includes: a minimum radius of the at least one sphere; a distance between the at least one sphere and the at least one nearest neighbor; and generating at least one new sphere such that the center of the at least one new sphere is positioned at a different position. may include.

In some embodiments, generating one or more spheres based on the plurality of parameters includes reducing the coverage of metric data provided by at least one sphere to at least one nearest neighbor sphere or at least one new sphere. and selecting a sphere that provides maximum coverage of metric data based on the comparison for generation of another new sphere.

In some embodiments, defining the plurality of parameters based on the metric data includes filtering out outliers from the metric data and defining coverage limits based at least in part on the filtered metric data. It may include doing.

According to another embodiment, one or more non-transitory machine-readable storage media includes a plurality of instructions stored thereon, the instructions being responsive to execution by at least one processor to provide a particular receiving metric data indicative of a plurality of time-series-based observations about a customer metric, each configured to capture a number of time-series-based observations about a particular customer metric based on the metric data; defining a plurality of parameters for characterizing one or more spheres, generating one or more spheres based on the plurality of parameters, and determining coverage of metric data within the one or more spheres. , a memory for detecting one or more anomalies in the metric data. Generating one or more spheres based on multiple parameters dynamically generates multiple spheres, each with a radius that changes based on multiple time series-based observations for a particular customer metric. may include doing.

In some embodiments, defining a plurality of parameters based on metric data includes defining a minimum radius for generating at least one sphere and generating at least one new sphere, each with a varying radius. The method may include defining a radius increment for generating the sphere and defining a coverage limit indicating a maximum number of metric data points covered by the generated sphere.

In some embodiments, generating one or more spheres based on the plurality of parameters may include determining a location corresponding to a maximum concentration of metric data based on a minimum radius.

In some embodiments, generating the one or more spheres based on the plurality of parameters includes determining whether a coverage limit has been reached and, in response to determining that the coverage limit has not been reached, determining the radius of the sphere. incrementing the radius to generate at least one new sphere based on the increment.

In some embodiments, generating one or more spheres based on the plurality of parameters includes determining whether at least one new sphere provides coverage of metric data not previously provided. and filtering out metric data already covered by the previous sphere in response to the determination that the at least one new sphere does not provide coverage of metric data not previously provided.

In some embodiments, generating one or more spheres based on the plurality of parameters includes determining that at least one new sphere provides coverage of metric data not previously provided. The method may include updating the radius and updating the position in response to a determination that the at least one new sphere provides coverage of metric data not previously provided.

In some embodiments, defining the plurality of parameters based on the metric data includes filtering out outliers from the metric data and defining coverage limits based at least in part on the filtered metric data. It may include doing.

According to yet another embodiment, a method for detecting anomalies in metric data provided by one or more customers comprises: each configured to receive, by the contact center system or computing device, and to capture a number of time-series-based observations for a particular customer metric by the contact center system or computing device based on the metric data. defining a plurality of parameters to characterize one or more spheres within the one or more spheres, and generating one or more spheres based on the plurality of parameters by a contact center system or computing device to and detecting one or more anomalies in the metric data. Generating one or more spheres based on a plurality of parameters may be performed by a contact center system or computing device to generate one or more spheres, each having a radius that varies based on multiple time-series-based observations for a particular customer metric. may include dynamically generating a sphere.

In some embodiments, defining the plurality of parameters based on the metric data includes, by the contact center system or computing device, defining a minimum radius for generation of at least one sphere; Defining, by a computing device, radius increments for generating one or more new spheres, each with a varying radius, and determining, by a contact center system or computing device, a maximum of metric data points covered by the generated spheres. defining a coverage limit indicating a number.

In some embodiments, generating the one or more spheres based on the plurality of parameters includes determining, by the contact center system or computing device, a location corresponding to a maximum concentration of metric data based on a minimum radius. may include.

In some embodiments, generating one or more spheres based on the plurality of parameters includes determining, by a contact center system or computing device, whether a coverage limit has been reached; and, in response to the determination that there is not, by the contact center system or computing device, incrementing a radius for generation of at least one new sphere based on the radius increment.

This summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used as an aid in limiting the scope of the claimed subject matter. Further embodiments, forms, features, and aspects of the present application will be apparent from the description and figures provided herewith.

The concepts described herein are illustrative by way of example and not as limiting in the accompanying drawings. For simplicity and clarity of illustration, the elements illustrated in the figures are not necessarily drawn to scale. Where considered appropriate, reference labels have been repeated between the drawings to indicate corresponding or similar elements.
1 is a simplified block diagram of at least one embodiment of a contact center system. FIG. 1 is a simplified block diagram of at least one embodiment of a computing device. FIG. 1 is a simplified flowchart of at least one embodiment of a method for detecting anomalies in data provided by one or more customers. 2 is a simplified flowchart of another embodiment of a method for detecting anomalies in data provided by one or more customers. 5 is a simplified flowchart of at least one embodiment of a method of generating one or more spheres that may be performed during the generation of spheres of the method of FIG. 4. FIG. A visual representation of a collection of metric data points/observations. 6 is a visual representation of a set of metric data points/observations with a sphere generated according to the method of FIG. 5; 6 is a visual representation of a set of metric data points/observations with two spheres generated according to the method of FIG. 5; FIG. 6 is a visual representation of a set of metric data points/observations with three spheres generated according to the method of FIG. 5; FIG. 2 is a visual representation of a set of metric data points/observations with multiple spheres generated according to a comparison method. 6 is a visual representation of a set of metric data points/observations with multiple spheres generated according to the method of FIG. 5; FIG. 2 is a visual representation of performance evaluation for various algorithms/models for detecting anomalies in various datasets. 3 is a visual representation of a collection of metric data with spheres generated according to a comparison method. 14 is a visual representation of the metric data set of FIG. 13 with a sphere generated according to the method of FIG. 5; FIG. 3 is a visual representation of a collection of metric data with spheres generated according to a comparison method. 16 is a visual representation of the metric data set of FIG. 15 with a sphere generated according to the method of FIG. 5; FIG. FIG. 7 is a graph diagram of abnormality detection information with respect to metrics obtained according to a comparison method. FIG. 6 is a graph of abnormality detection information for metrics obtained according to the method of FIG. 5;

While the concepts of the disclosure are susceptible to various modifications and alternative forms, specific embodiments have been shown by way of example in the drawings and will herein be described in detail. However, there is no intent to limit the concept of this disclosure to the particular forms disclosed, but on the contrary, the intent is to cover all modifications, equivalents, and alternatives consistent with this disclosure and the appended claims. Please understand that this is intended to be comprehensive.

References herein to "one embodiment," "one embodiment," "illustrative embodiment," and the like refer to all references herein, although the described embodiment may include a particular feature, structure, or characteristic. Indicates that embodiments of may or may not necessarily include a particular feature, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. Although reference to a "preferred" component or feature may indicate the desirability of a particular component or feature with respect to one embodiment, this disclosure does not discuss other implementations in which such component or feature may be omitted. It is further understood that there is no such limitation as to form. Furthermore, when a particular feature, structure, or characteristic is described in connection with an embodiment, it also applies to such feature, structure, or characteristic in connection with other embodiments, whether or not explicitly described. implementation shall be within the knowledge of those skilled in the art. Furthermore, the particular features, structures, or characteristics may be combined in any suitable combinations and/or subcombinations in various embodiments.

Furthermore, items included in the list of the form "at least one of A, B, and C" are (A), (B), (C), (A and B), (B and C), It is to be understood that it can mean (A and C), or (A, B, and C). Similarly, items listed in the form "at least one of A, B, or C" are (A), (B), (C), (A and B), (B and C), ( It should be understood that it can mean A and C) or (A, B, and C). Further, with reference to the claims, "a", "an", "at least one", and/or "at least one portion" The use of words and phrases such as ``at least some of'' should not be construed as limiting to only one such element, unless specifically stated to the contrary, Use of phrases such as "at least a portion" and/or "a portion" refers to embodiments that include only a portion of such elements, unless specifically stated to the contrary. and embodiments containing such elements in their entirety.

The disclosed embodiments may be implemented in hardware, firmware, software, or a combination thereof, as the case may be. The disclosed embodiments also include instructions executed or stored on one or more temporary or non-transitory machine-readable (e.g., computer-readable) storage media that can be read and executed by one or more processors. Can be implemented. Machine-readable storage medium is any storage device, mechanism, or other storage medium for storing or transmitting information in a form readable by a machine (e.g., volatile or non-volatile memory, media disk, or other media device). Can be embodied as a physical structure.

In the drawings, the several structural or methodical features may be shown in a specific arrangement and/or ordering. However, it should be understood that such specific arrangement and/or ordering may not be required. Rather, in some embodiments, such features may be arranged in a different manner and/or order than that shown in the illustrative figures, unless indicated to the contrary. Furthermore, the inclusion of structural or methodological features in a particular figure does not imply that such features are required in all embodiments, and in some embodiments, they may not be included. or may be combined with other features.

For data collection and/or data analysis purposes, in some applications it may be beneficial to check whether a new observation/data point belongs to the same data distribution as an existing observation/data point. . Observation(s) that belong to the same data distribution as an existing observation may be referred to herein as an inlier, and observation(s) that do not belong to the same distribution as an existing observation may be referred to herein as an inlier. In this specification, it may be referred to as an outlier. The ability to distinguish between inliers and outliers can be particularly useful in cleaning real data sets.

It should be appreciated that outliers in data (e.g., training data) can often be defined as observations that are far apart from others based on one or more visual representations of the data. . Therefore, in some cases, the outlier detection estimator may attempt to fit and/or capture the regions where the data is most concentrated, while typically ignoring deviant observations or outliers.

However, in some cases, outliers may not yet exist in the data of interest. In those cases, it may be beneficial to detect whether the new observation is an outlier. A new observation detected to be an outlier may, in at least some embodiments, be a novelty. Furthermore, detection of such outliers may be referred to herein as novelty detection.

Outlier detection and novelty detection can be performed to detect anomalies in data, especially when detection of anomalous observations is desired. Outlier detection is sometimes referred to as "unsupervised anomaly detection" and novelty detection is sometimes referred to as "semi-supervised anomaly detection." In the context of outlier detection, estimators often assume that outliers/anomalies are located in areas of low density/concentration, so outliers/anomalies typically form dense clusters. Can not. However, in the context of novelty detection, novelties/anomalies may form dense clusters as long as they are located in areas of low density/concentration of data that can be considered normal.

The systems and methods of the present disclosure are configured to implement a model referred to below as the Isolation Nearest Spheres (INS) model. INS models are derived from the need to visualize how the systems, methods, and/or tools used to implement the model learn different behaviors for different metrics, thereby making suggestions I hope you understand that this will happen. Furthermore, INS models rely on visual representations and/or graphical depictions that can be used to detect and assess the severity of anomalies. As a result, anomaly detection for time series observations may be considered analogous to, or otherwise signaled by, outlier detection in multivariate systems. In order to relate anomaly detection on time series observations to outlier detection in multivariate systems, this disclosure provides a method for detecting outliers from time series data that is useful for describing the continuous behavior of various metrics and is sensitive to outliers. Assume extraction of useful features.

In some embodiments, the present disclosure provides machine learning algorithms for detecting anomalies in any time-series metric data that generates models. In some cases, the anomaly detection models contemplated herein are unsupervised and do not require any parameter definitions to learn normal behavior from metric data. Additionally, in some cases, the behavior learned from the metric data is based on knowledge spheres, each having a dynamic radius within one or more dense regions.

In some embodiments, this disclosure contemplates a feature selection process or mechanism for time series-based observations for various metrics. The process may include consideration of the (visual) representation of time-series-based metric data, sensitivity to outliers in the data, and standardization of the data (eg, ensuring dimensional capacity of the dataset). Taking those considerations into account, the number of features (e.g., n) selected and/or determined according to the techniques of this disclosure may be determined by the current value/observed value for a particular metric and the historical value for that metric. /observations (e.g., observations received within the previous hour or day). In some embodiments, the n features contemplated by this disclosure may include, but are not limited to, metric values, derivatives, and moving averages.

For purposes of this disclosure, the definitions provided below are applicable to subsequent discussion of the defined terms.
• Separation - reduction of data into specific knowledge units (i.e. performed by the INS model). Such reduction is performed to reach the knowledge limit.
- Nearest Neighbors - INS models rely on nearest neighbor distances to determine the proximity between data points. These distances are refined and/or improved using data associated only with uncovered behavior.
• Sphere - a unit of knowledge visually represented as a cluster of data points/observations. Each knowledge unit is defined by a dynamic radius and center.
• Behavior - the number of each of the features for a particular metric (eg, n).
• Coverage - Percentage of observations/data points located inside/covered by all spheres.

Further explanation of the INS model and the terms defined above is provided below with reference to FIGS. 3-5.

Referring now to FIG. 1, a simplified diagram of at least one embodiment of a communications infrastructure and/or contact center system that may be used in conjunction with one or more of the embodiments described herein. A block diagram is shown. In an exemplary embodiment, contact center system 100 is embodied as a system configured to implement an INS model to detect anomalies in data provided by one or more customers. , or otherwise contain it. Contact center system 100 is capable of providing contact center services (e.g., call center services, chat center services, SMS center services, etc.) to end users and performing the functions otherwise described herein. It can be implemented as any system. The example contact center system 100 includes a customer device 102, a network 104, a switch/media gateway 106, a call controller 108, an interactive media response (IMR) server 110, a routing server 112, a storage device 114, a statistical server 116, agent devices 118A, 118B, 118C, media server 120, knowledge management server 122, knowledge system 124, chat server 126, web server 128, interaction (iXn) server 130, universal contact server 132, reporting server 134, media services It includes a server 136 and an analysis module 138. The illustrative embodiment of FIG. 1 includes one customer device 102, one network 104, one switch/media gateway 106, one call controller 108, one IMR server 110, one routing server 112, one storage device 114, one statistics server 116, one media server 120, one knowledge management server 122, one knowledge system 124, one chat server 126, one iXn server 130, one universal contact server 132, one Although only a reporting server 134, one media services server 136, and one analytics module 138 are shown, contact center system 100 may include multiple customer devices 102, networks 104, switches/media gateways, etc. in other embodiments. 106, call controller 108, IMR server 110, routing server 112, storage device 114, statistics server 116, media server 120, knowledge management server 122, knowledge system 124, chat server 126, iXn server 130, universal contact server 132, reporting server 134, a media services server 136, and/or an analysis module 138. Furthermore, in some embodiments, one or more of the components described herein may be excluded from system 100, such that one or more of the components described as independent The foregoing may form part of another component, and/or one or more of the components described as forming part of another component may be independent.

While the term "contact center system" is used herein to refer to the system depicted in FIG. 1 and/or its components, the term "contact center" more generally refers to It should be understood that it is used to refer to center systems, the customer service providers that operate these systems, and/or their associated organizations or businesses. Accordingly, unless specifically limited otherwise, the term "contact center" generally refers to a contact center system (such as contact center system 100), an associated customer service provider (such as a particular customer service provider providing customer service through contact center system 100) service providers, etc.) as well as organizations or companies on whose behalf customer service is provided.

By way of background, customer service providers may offer many types of services through contact centers. Such contact centers may be staffed by employees or customer service agents (or simply "Agents"), who may be employed by a company, corporation, government agency, or organization (hereinafter interchangeably "Organization" or "Enterprise"). (hereinafter interchangeably referred to as "individuals" or "customers"), such as users, individuals, or customers. For example, a contact center agent may assist customers in making purchasing decisions, accepting orders, or resolving issues with products or services already received. Within a contact center, such interactions between contact center agents and external entities or customers may include, for example, voice (e.g., telephone calls or voice over IP, i.e., VoIP calls), video (e.g., video conferencing), It may take place via various communication channels, such as text (e.g., email and text chat), screen sharing, co-browsing, and/or other communication channels.

Operationally, contact centers generally strive to provide quality service to customers while minimizing costs. For example, one way a contact center operates is to handle all customer interactions with live agents. While this approach could be quite successful from a service quality perspective, it would likely be prohibitively expensive due to the high cost of agent labor. Therefore, instead of live agents, most contact centers use, for example, interactive voice response (IVR) systems, interactive media response (IMR) systems, Internet robots, or "bots," and automated chat services. Utilizes some level of automated processes, such as modules, ie, "chatbots," and/or other automated processes. This can often be a successful strategy as automated processes can be very efficient at handling certain types of interactions and effective at reducing the need for live agents. It has been proven. Such automation allows contact centers to target the use of human agents to more difficult customer interactions, while automated processes handle more repetitive or routine tasks. Additionally, automated processes can be structured in ways that optimize efficiency and promote repeatability. Human agents, or live agents, can forget to respond to a particular question or follow up on a particular detail, but such errors are typically avoided through the use of automated processes. Ru. While customer service providers increasingly rely on automated processes to interact with customers, the use of such technology by customers remains far less developed. Thus, on the contact center side of the interaction, IVR systems, IMR systems, and/or bots are used to automate parts of the interaction, while actions on the customer side remain manually performed by the customer.

It should be appreciated that contact center system 100 may be used by customer service providers to provide various types of services to customers. For example, contact center system 100 may be used to engage in and manage interactions in which automated processes (or bots) or human agents communicate with customers. As should be understood, contact center system 100 may be an in-house facility of a business or corporation for performing sales and customer service functions related to products and services available through the business. In another embodiment, contact center system 100 may be operated by a third party service provider that contracts to provide services on behalf of another organization. Additionally, contact center system 100 may be deployed on equipment dedicated to a company or a third-party service provider and/or may be a private or It may be deployed within a remote computing environment, such as a public cloud environment. Contact center system 100 may include software applications or programs that may be executed on-premises or remotely, or some combination thereof. Furthermore, it should be appreciated that the various components of contact center system 100 may be distributed across various geographic locations and are not necessarily contained within a single location or computing environment.

Furthermore, unless specifically limited otherwise, it should be understood that any of the computing elements described herein may be implemented within a cloud-based or cloud computing environment. As used herein and further described below in connection with computing device 200, "cloud computing" or simply "cloud" refers to configurable computing resources (e.g., networks, servers, storage, defined as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of devices (devices, applications, and services) that can be rapidly provisioned through virtualization and with minimal management. It can be released with effort or service provider interaction and then scaled accordingly. Cloud computing has various characteristics (e.g., on-demand self-service, wide area network access, resource pooling, rapid elasticity, measurable service, etc.), service models (e.g., Software as a Service, Platform as a Service (“PaaS”), Infrastructure as a Service (“IaaS”), and deployment models (e.g., private cloud, community cloud, public cloud) Cloud execution models, often referred to as “serverless architectures,” generally involve service providers dynamically managing the allocation and provisioning of remote servers to achieve desired functionality.

Any of the computer-implemented components, modules, or servers described in connection with FIG. 1 may be implemented via one or more types of computing devices, such as, for example, computing device 200 of FIG. I hope you understand that. As will be appreciated, contact center system 100 generally includes resources (e.g., personnel, computers, telecommunications equipment, etc.) to enable delivery of services via telephone, email, chat, or other communication mechanisms. etc.). Such services may vary depending on the type of contact center and may include, for example, customer service, help desk functions, emergency response, telemarketing, order fulfillment, and/or other features.

A customer desiring to receive service from contact center system 100 may initiate inbound communication (eg, phone call, email, chat, etc.) to contact center system 100 via customer device 102 . Although FIG. 1 depicts one such customer device, customer device 102, it should be understood that any number of customer devices 102 may be present. Customer device 102 can be, for example, a communication device such as a telephone, smart phone, computer, tablet, or laptop. In accordance with the features described herein, customers generally use customer device 102 to conduct contact center transactions, such as phone calls, emails, chats, text messages, web browsing sessions, and other multimedia transactions. Communication with system 100 may be initiated, managed, and performed.

Inbound and outbound communications from and to customer device 102 may typically traverse network 104, with the nature of the network depending on the type of customer device being used and the form of communication. . As an example, network 104 may include a telephone, cellular, and/or data service communication network. Network 104 may include a private or public switched telephone network (PSTN), a local area network (LAN), a private wide area network (WAN), and/or a public WAN, such as the Internet. It can be. Additionally, network 104 may include a code division multiple access (CDMA) network, a global system for mobile communications (GSM) network, or a 3G, 4G, LTE, 5G, etc. , including, but not limited to, any wireless network/technology conventional in the art.

Switch/media gateway 106 may be coupled to network 104 for receiving and transmitting telephone calls between customers and contact center system 100. The switch/media gateway 106 may include a telephone switch or a communications switch configured to act as a central switch for agent-level routing within a center. A switch can be a hardware switching system or implemented via software. For example, the switch 106 may receive Internet-sourced interactions and/or telephone network-sourced interactions from automated call distributors, private branch exchanges (PBXs), IP-based software switches, and/or customers, and may For example, any other switch having specialized hardware and software configured to route the agent to one of the agent devices 118. Thus, in general, switch/media gateway 106 establishes a voice connection between a customer and an agent by establishing a connection between customer device 102 and agent device 118.

As further shown, the switch/media gateway 106 may be coupled to a call controller 108 that serves, for example, as an adapter or interface connection between the switch and other routing, monitoring, and communication processing components of the contact center system 100. . Call controller 108 may be configured to handle PSTN calls, VoIP calls, and/or other types of calls. For example, call controller 108 may include computer-telephone integration (CTI) software for interfacing with switches/media gateways and other components. Call controller 108 may include a SIP server for processing session initiation protocol (SIP) calls. Call controller 108 may also extract data about the incoming interaction, such as the customer's phone number, IP address, or email address, and then communicate these with other contact center components in processing the interaction.

Interactive media response (IMR) server 110 may be configured to enable self-help or virtual assistant functionality. Specifically, IMR server 110 may be similar to an interactive voice response (IVR) server, except that IMR server 110 is not limited to voice and may also cover various media channels. In an example illustrating voice, the IMR server 110 may be configured with an IMR script to query the customer about the customer's needs. For example, a bank's contact center may instruct a customer via an IMR script to "press 1" if the customer wants to retrieve his or her bank balance. Through continuous interaction with the IMR server 110, customers may receive service without the need to speak to an agent. IMR server 110 may also be configured to ascertain the reason a customer is contacting the contact center so that communications can be routed to the appropriate resource. IMR configuration is performed through the use of self-service and/or assisted service tools, including web-based tools for developing IVR and routing applications that run within a contact center environment (e.g., Genesys® Designer) can be done.

Routing server 112 may function to route incoming interactions. For example, if it is determined that an inbound communication should be handled by a human agent, functionality within routing server 112 may select the most appropriate agent and route the communication to that agent. This agent selection may be based on which available agent is best suited to handle the communication. More specifically, selection of the appropriate agent may be based on a routing strategy or algorithm implemented by routing server 112. In doing so, the routing server 112 may query data related to the incoming interaction, such as data related to the particular customer, available agents, and type of interaction, which data is described herein. may be stored in a particular database as specified. Once an agent is selected, routing server 112 may interact with call controller 108 to route (ie, connect) the incoming interaction to the corresponding agent device 118. As part of this connection, information about the customer may be provided to selected agents via their agent devices 118. This information is intended to enhance the service agents can provide to their customers.

It is noted that contact center system 100 may include one or more mass storage devices (generally represented by storage device 114) for storing data in one or more databases related to contact center functions. I want to be understood. For example, storage device 114 may store customer data maintained in a customer database. Such customer data may include, for example, customer profiles, contact information, service level agreements (SLAs), and interaction history (e.g., nature of previous interactions, disposition data, latency, processing times, and details of previous interactions with a particular customer, including actions taken by the contact center to resolve the customer's issue). As another example, storage device 114 may store agent data in an agent database. Agent data maintained by contact center system 100 may include, for example, agent availability and agent profiles, schedules, skills, handling times, and/or other related data. As another example, storage device 114 may store interaction data in an interaction database. Interaction data may include, for example, data related to a number of past interactions between a customer and a contact center. More generally, unless specifically specified otherwise, storage device 114 includes a database and/or is configured to store data related to any of the types of information described herein. It should be understood that these databases and/or data can be accessed by other modules or servers of contact center system 100 in a manner that facilitates the functionality described herein. For example, a server or module of contact center system 100 may interrogate such a database to retrieve data stored within the database or transmit data to the database for storage. Storage device 114 may, for example, take the form of any conventional storage medium and may be stored locally or operated from a remote location. As an example, the database is a Cassandra database, a NoSQL database, or an SQL database, and may be managed by a database management system such as Oracle, IBM DB2, Microsoft SQL Server, or Microsoft Access, PostgreSQL.

Statistics server 116 may be configured to record and aggregate data related to the performance and operational aspects of contact center system 100. Such information may be compiled by statistics server 116 and made available to other servers and modules, such as reporting server 134, which in turn uses the data to manage the operational aspects of the contact center. and may generate reports that are used to perform automated actions in accordance with the functionality described herein. Such data may relate to the state of the contact center's resources, such as average wait time, abandonment rate, agent occupancy, and others as may be required by the functionality described herein.

Agent device 118 of contact center system 100 may be a communication device configured to interact with various components and modules of contact center system 100 in a manner that facilitates the functionality described herein. . For example, agent device 118 may include a telephone adapted for regular telephone calls or VoIP calls. Agent device 118 communicates with servers of contact center system 100, performs data processing associated with operations, and provides voice, chat, email, and other multimedia communication mechanisms in accordance with the functionality described herein. The computer may further include a computing device configured to interface with the customer via the computer. Although FIG. 1 shows three such agent devices 118, namely agent devices 118A, 118B, and 118C, it should be understood that any number of agent devices 118 may be present in a particular embodiment.

Multimedia/social media server 120 may be configured to facilitate (non-voice) media interaction with customer device 102 and/or server 128. Such media interactions may involve, for example, email, voice mail, chat, video, text messaging, web, social media, co-browsing, etc. Multimedia/social media server 120 may take the form of any IP router conventional in the art with specialized hardware and software for receiving, processing, and forwarding multimedia events and communications.

Knowledge management server 122 may be configured to facilitate interaction between customers and knowledge system 124. Generally, knowledge system 124 may be a computer system that can receive questions or queries and provide answers in response. Knowledge system 124 may be included as part of contact center system 100 or operated remotely by a third party. Knowledge system 124 can answer questions posed in natural language by obtaining information from sources such as encyclopedias, dictionaries, newswire articles, literary works, or other documents submitted to knowledge system 124 as reference materials. may include an artificially intelligent computer system capable of answering questions. As an example, knowledge system 124 may be embodied as an IBM Watson or similar system.

Chat server 126 may be configured to conduct, orchestrate, and manage electronic chat communications with customers. Generally, chat server 126 is configured to implement and maintain chat conversations and generate chat transcripts. Such chat communications may be conducted by chat server 126 in such a way that the customer communicates with an automated chatbot, a human agent, or both. In an example embodiment, chat server 126 may function as a chat orchestration server that dispatches chat conversations between chatbots and available human agents. In such cases, the processing logic of chat server 126 may be rule driven to take advantage of intelligent workload distribution among available chat resources. Chat server 126 may further implement, manage, and facilitate UIs associated with chat functionality, including user interfaces (UIs) generated on either customer device 102 or agent device 118. The chat server 126 auto-sources chats within a single chat session with a particular customer, such that the chat session is transferred from a chatbot to a human agent or from a human agent to a chatbot. May be configured to transfer to and from human sources. Chat server 126 is also coupled to knowledge management server 122 and knowledge system 124 to receive suggestions and answers to inquiries submitted by customers during the chat, such that links to related articles may be provided, for example. can be done.

A web server 128 may be included to provide site hosting for various social interaction sites to which customers subscribe, such as Facebook, Twitter, Instagram, etc. Although depicted as part of contact center system 100, it should be understood that web server 128 may be provided by a third party and/or maintained remotely. Web server 128 may also serve web pages for businesses or organizations supported by contact center system 100. For example, a customer may view a web page and receive information about a particular company's products and services. Within such a company's web page, a mechanism may be provided for initiating interaction with contact center system 100, for example via web chat, voice, or email. An example of such a mechanism is a widget that can be deployed on a web page or website hosted on web server 128. As used herein, widget refers to a user interface component that performs a specific functionality. In some implementations, widgets may include graphical user interface controls that may be overlaid on web pages displayed to customers over the Internet. A widget presents information, such as in a window or text box, or contains buttons or other controls that allow the user to access certain functionality, such as sharing or opening a file, or initiating a communication. obtain. In some implementations, widgets include user interface components that have portable portions of code that can be installed and executed within a separate web page without compilation. Some widgets may include corresponding or additional user interfaces to connect various local resources (e.g., calendar or contact information on the customer's device) or remote resources (e.g., instant messaging, email, or social networking updates).

Interaction (iXn) server 130 may be configured to manage contact center deferrable activities and the routing of those activities to human agents for completion. As used herein, deferrable activities include back-office work that can be performed offline, such as responding to emails, attending training, and not requiring real-time communication with customers. Other activities may be mentioned. As one example, interaction (iXn) server 130 may be configured to interact with routing server 112 to select an appropriate agent to handle each deferrable activity. Once assigned to a particular agent, the deferrable activity is pushed to that agent such that the deferrable activity is displayed on the selected agent's agent device 118. Deferrable activities may be displayed in the workbin as tasks for the selected agent to complete. Workbin functionality may be implemented via any conventional data structure, such as, for example, a linked list, an array, and/or other suitable data structure. Each of agent devices 118 may include a workbin. As one example, a workbin may be maintained in a buffer memory of a corresponding agent device 118.

A universal contact server (UCS) 132 may be configured to retrieve information stored in the customer database and/or transmit information to the customer database for storage therein. For example, the UCS 132 may be utilized as part of a chat feature to facilitate maintaining a history of how chats with a particular customer were handled, and this history may then be used in future chats. It can be used as a reference on how to handle communications. More generally, UCS 132 may be configured to facilitate maintaining a history of customer preferences, such as preferred media channels and best times to contact. To do this, UCS 132 may be configured to identify data related to each customer's interaction history, such as, for example, data regarding comments from agents, customer communication history, and the like. Each of these data types can then be stored in a customer database or other module and retrieved as needed by the functionality described herein.

Reporting server 134 may be configured to generate reports from data compiled and aggregated by statistics server 116 or other sources. Such reports may include near real-time reports or historical reports, and may relate to the state of contact center resources and performance characteristics, such as, for example, average wait time, abandonment rate, and/or agent occupancy. Reports may be generated automatically or in response to a specific request from a requester (eg, agent, administrator, contact center application, etc.). The reports may then be used to manage contact center operations in accordance with the functionality described herein.

Media services server 136 may be configured to provide audio and/or video services to support contact center functionality. According to the features described herein, such features include IVR or IMR system prompts (e.g., playing audio files), music on hold, voicemail/single-party recording, multi-party recording ( (of audio and/or video calls), voice recognition, dual tone multi frequency (DTMF) recognition, fax, audio and video transcoding, secure real-time transport protocol (SRTP) ), teleconferencing, video conferencing, coaching (e.g., support for coaches to overhear interactions between customers and agents, and for coaches to provide comments to agents without the customer hearing the comments); Call analysis, keyword spotting, and/or other related features may be mentioned.

Analysis module 138 may be configured to provide systems and methods for performing analysis on data received from multiple different data sources, as may be required by the functionality described herein. . According to example embodiments, analysis module 138 also generates, updates, trains, and modifies predictors or models based on collected data, such as, for example, customer data, agent data, and interaction data. It is possible. The model may include a customer or agent behavior model. Behavioral models may be used to predict the behavior of, for example, customers or agents in a variety of situations, such that embodiments of the techniques described herein can tailor interactions based on such predictions. Enables the ability to adjust or allocate resources for anticipated characteristics of future interactions, thereby improving overall contact center performance and customer experience. Although the analytics module is described as being part of the contact center, such behavioral models may also be implemented in the customer system (or as used herein, the "customer side" of the interaction). It will be appreciated that the terms and conditions may be used for the benefit of the customer.

According to an example embodiment, analysis module 138 may have access to data stored on storage device 114 including a customer database and an agent database. The analysis module 138 also analyzes interactions and interaction content (e.g., transcripts of interactions and events detected therein), interaction metadata (e.g., customer identifier, agent identifier, medium of interaction, length of interaction, interaction initiation and end time, department, tagged categories), as well as an interaction database that stores data related to application settings (eg, interaction paths through a contact center). Additionally, analysis module 138 may be configured to retrieve data stored within storage device 114 for use in developing and training algorithms and models, for example, by applying machine learning techniques. .

One or more of the included models may be configured to predict aspects related to customer or agent behavior and/or contact center operation and performance. Additionally, one or more of the models may be used for natural language processing, including, for example, intent recognition. A model may be developed based on known first-principles equations that describe the system, data that yields an experimental model, or a combination of known first-principles equations and data. In developing models for use in this embodiment, first-principles equations are often not available or easily derived, so we build empirical models based on collected and stored data. may generally be preferred. In some embodiments, it may be preferable for the model to be non-linear in order to adequately capture the relationship between manipulated/disturbed variables and control variables of a complex system. This may result in nonlinear models exhibiting a curvilinear rather than linear relationship between manipulated/disturbance variables and controlled variables, which is common in complex systems such as those considered herein. It's for a reason. Considering the aforementioned requirements, machine learning or neural network-based approaches may be the preferred embodiments for implementing the model. For example, neural networks can be developed based on empirical data using sophisticated regression algorithms.

Analysis module 138 may further include an optimizer. As will be appreciated, an optimizer can be used to minimize a "cost function" object to which a set of constraints are applied, where a cost function is a mathematical representation of a desired objective or system behavior. Since the model may be non-linear, the optimizer may be a non-linear programming optimizer. However, the techniques described herein include, but are not limited to, linear programming, quadratic programming, mixed integer nonlinear programming, stochastic programming, global nonlinear programming, genetic algorithms, particle/swarm techniques, etc. It is contemplated that it may be implemented using a variety of different types of optimization approaches, individually or in combination.

According to some embodiments, a model and an optimizer may be used together within an optimization system. For example, analysis module 138 may utilize the optimization system as part of an optimization process in which aspects of contact center performance and operation are optimized or at least enhanced. This may include, for example, features related to customer experience, agent experience, interaction routing, natural language processing, intent recognition, or other functionality related to automated processes.

The various components, modules, and/or servers of FIG. 1 (as well as other figures included herein) each execute computer program instructions and perform various functions described herein. It may include one or more processors that interact with other system components for purposes. Such computer program instructions may be stored in memory implemented using standard memory devices such as, for example, random-access memory (RAM), or e.g. It may be stored on other non-transitory computer readable media such as a drive. Although the functionality of each of the servers is described as being provided by a particular server, those skilled in the art will appreciate that the functionality of the various servers may be combined or consolidated into a single server, or that the functionality of the various servers may be It should be understood that the functionality of a server may be distributed across one or more other servers without departing from the scope of the techniques described herein. Furthermore, the terms "interaction" and "communication" are used interchangeably and generally refer to phone calls (PSTN or VoIP calls), emails, V-mails, videos, chats, screen shares, text messages, social media messages, Refers to any real-time and non-real-time interactions using any communication channel, including but not limited to WebRTC calls and the like. Access to and control of components of contact center system 100 may be effected through a user interface (UI) that may be generated on customer device 102 and/or agent device 118. As previously mentioned, contact center system 100 may be operated as a hybrid system in which some or all components are hosted remotely, such as in a cloud-based or cloud computing environment. Each of the devices of contact center system 100 may be embodied as part of or include one or more computing devices similar to computing device 200 described below with reference to FIG. It is to be understood that it is possible to form

Referring now to FIG. 2, a simplified block diagram of at least one embodiment of a computing device 200 is shown. In an exemplary embodiment, computing device 200 is embodied as a system configured to implement an INS model to detect anomalies in data provided by one or more customers. , or otherwise contain it. Exemplary computing device 200 may include any computing device, system, servicer, controller, switch, gateway, engine, module, and/or computing component described herein (e.g., for brevity herein). 2 depicts at least one embodiment of each of the following (which, collectively, may be interchangeably referred to as a computing device, server, or module). For example, various computing devices may be running computer program instructions and interacting with other system modules to perform the various functions described herein. It may be a process or thread running on one or more processors of the computing device 200 described above. Unless specifically limited to the contrary, functionality described in connection with multiple computing devices may be integrated into a single computing device or functions described in connection with a single computing device may be integrated into a single computing device. Functionality may be distributed across several computing devices. Further, in the context of a computing system described herein, such as contact center system 100 of FIG. on-site at the same physical location), a remote computing device 200 (e.g., off-site, i.e., in a cloud-based environment, or within a cloud computing environment, e.g., in a remote data center connected via a network); It may be located on some combination thereof. In some embodiments, the functionality provided by servers located on off-site computing devices is provided through a virtual private network (VPN) as if such servers were on-site. Access and functionality may be provided using software as a service (SaaS) accessed over the Internet using a variety of protocols, e.g., extensible markup languages. (extensible markup language, XML), JSON, and/or functionality may be accessed/exploited differently.

In some embodiments, computing device 200 is a server, a desktop computer, a laptop computer, a tablet computer, a notebook, a netbook, an Ultrabook, a cell phone, a mobile computing device, a smart phone, a wearable computing device. , personal digital assistants, Internet of Things (IoT) devices, processing systems, wireless access points, routers, gateways, and/or any other computer capable of performing the functions described herein. may be embodied as a processing device, a processing device, and/or a communication device.

Computing device 200 includes a processing device 202 that executes algorithms and/or processes data according to operational logic 208 and input/output that enables communication between computing device 200 and one or more external devices 210. device 204 and memory 206 for storing data received from external device 210 via input/output device 204, for example.

Input/output devices 204 enable computing device 200 to communicate with external devices 210. For example, the input/output device 204 may include a transceiver, a network adapter, a network card, an interface, one or more communication ports (e.g., USB port, serial port, parallel port, analog port, digital port, VGA, DVI, HDMI, FireWire). , CAT5, or any other type of communication port or interface), and/or other communication circuitry. The communications circuitry of computing device 200 may include any one or more communications technologies (e.g., wireless or wired communications) and associated protocols (e.g., Ethernet, Bluetooth, Wi-Fi, WiMAX, etc.). may be configured to perform such communications depending on the particular computing device 200. Input/output device 204 may include suitable hardware, software, and/or firmware to implement the techniques described herein.

External device 210 may be any type of device that allows data to be input to or output from computing device 200. For example, in various embodiments, external device 210 may be embodied as one or more of the devices/systems and/or portions thereof described herein. Further, in some embodiments, external device 210 may include another computing device, switch, diagnostic tool, controller, printer, display, alarm, peripheral device (e.g., keyboard, mouse, touch screen display, etc.), and/or or any other computing, processing, and/or communication device capable of performing the functions described herein. Furthermore, it should be appreciated that in some embodiments, external device 210 may be integrated with computing device 200.

Processing device 202 may be embodied as any type of processor capable of performing the functions described herein. In particular, processing device 202 may be embodied as one or more single-core or multi-core processors, microcontrollers, or other processors or processing/control circuits. For example, in some embodiments, processing device 202 includes an arithmetic logic unit (ALU), a central processing unit (CPU), a digital signal processor (DSP), a graphics processing a graphics processing unit (GPU), a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), and/or another suitable processor; or may be embodied as such. Processing device 202 may be of the programmable type, a dedicated hardwired state machine, or a combination thereof. Processing device 202 having multiple processing units may utilize distributed processing, pipeline processing, and/or parallel processing in various embodiments. Furthermore, processing device 202 may be dedicated to performing only the operations described herein or may be utilized in one or more additional applications. In the exemplary embodiment, processing device 202 is programmable and executes algorithms and/or processes data according to operational logic 208 defined by programming instructions (such as software or firmware) stored in memory 206. do. Additionally or alternatively, operational logic 208 of processing device 202 may be defined at least in part by hardwired logic or other hardware. Additionally, processing device 202 includes one or more components of any type suitable for processing signals received from input/output device 204 or from other components or devices and providing a desired output signal. may be included. Such components may include digital circuits, analog circuits, or a combination thereof.

Memory 206 may be one or more types of non-transitory computer readable media, such as solid state memory, electromagnetic memory, optical memory, or combinations thereof. Additionally, memory 206 may be volatile and/or non-volatile; in some embodiments, some or all of memory 206 may be a disk, tape, memory stick, cartridge, and/or other suitable device. It may be of a portable type, such as a portable memory. During operation, memory 206 may store various data and software used during operation of computing device 200, such as an operating system, applications, programs, libraries, and drivers. In addition to or in lieu of storing programming instructions that define operational logic 208, memory 206 represents, for example, signals received from and/or transmitted to input/output devices 204. It should be appreciated that data manipulated by operational logic 208 of processing device 202 may be stored, such as data. As shown in FIG. 2, memory 206 may be included in and/or coupled to processing device 202, depending on the particular embodiment. For example, in some embodiments, processing device 202, memory 206, and/or other components of computing device 200 form part of a system-on-a-chip (SoC). , can be incorporated into a single integrated circuit chip.

In some embodiments, various components of computing device 200 (e.g., processing device 202 and memory 206) may be communicatively coupled via an input/output subsystem that includes: It may be embodied as circuitry and/or components to facilitate input/output operations with processing device 202, memory 206, and other components of computing device 200. For example, the input/output subsystem may include a memory controller hub, an input/output control hub, a firmware device, a communication link (i.e., point-to-point link, bus link, wire, cable, light guide, printed circuit board trace, etc.), and/or It may be embodied in or otherwise include other components and subsystems to facilitate input/output operations.

Computing device 200, in other embodiments, may include other or additional components, such as those commonly found in typical computing devices (e.g., various input/output devices and/or other components). may include. It is further understood that one or more of the components of computing device 200 described herein may be distributed across multiple computing devices. In other words, the techniques described herein may be employed by a computing system that includes one or more computing devices. Additionally, although only a single processing device 202, I/O device 204, and memory 206 are illustratively shown in FIG. It should be appreciated that processing devices 202, I/O devices 204, and/or memory 206 may be included. Additionally, in some embodiments, more than one external device 210 may communicate with computing device 200.

Computing device 200 may be one of multiple devices connected by a network or to other systems/resources via a network. A network may be embodied as any one or more types of communication networks that can facilitate communications between various devices communicatively connected through the network. Accordingly, a network may include one or more networks, routers, switches, access points, hubs, computers, client devices, endpoints, and/or other intervening network devices. For example, the network may be embodied as one or more cellular networks, telephone networks, local or wide area networks, publicly available global networks (e.g., the Internet), ad hoc networks, short-range communication links, or combinations thereof. or may otherwise include them. In some embodiments, the network may include a circuit-switched voice or data network, a packet-switched voice or data network, and/or any other network capable of carrying voice and/or data. In particular, in some embodiments, the network may include an Internet Protocol (IP)-based network and/or an asynchronous transfer mode (ATM)-based network. In some embodiments, the network may transmit voice traffic (e.g., via a Voice over IP (VOIP) network), web traffic, and/or other network traffic to certain embodiments and/or It can be handled depending on the devices of the system that communicate with each other. In various embodiments, the networks include analog or digital wired and wireless networks (e.g., IEEE 802.11 networks, public switched telephone networks (PSTN), Integrated Services Digital Networks (ISDN), and digital subscriber networks). (Digital Subscriber Line, xDSL)), Third Generation (3G) mobile communication network, Fourth Generation (4G) mobile communication network, Fifth Generation (5G) mobile communication network, wired Ethernet network, private network (e.g., intranet, etc.), radio, television, cable, satellite, and/or any other distribution or tunneling mechanism for conveying data, or any suitable of such networks. may include combinations. It should be appreciated that various devices/systems may communicate with each other via different networks depending on the source and/or destination devices/systems.

It should be appreciated that computing device 200 may communicate with other computing devices 200 via any type of gateway or tunneling protocol, such as secure socket layer or transport layer security. Network interfaces include embedded network adapters, such as network interface cards, suitable for interfacing the computing device to any type of network capable of performing the operations described herein. obtain. Additionally, the network environment may be a virtual network environment in which various network components are virtualized. For example, the various machines can be virtual machines implemented as software-based computers running on physical machines. The virtual machines may share the same operating system, or in other embodiments, different operating systems may run on each virtual machine instance. For example, a "hypervisor" type of virtualization is used, where multiple virtual machines run on the same host physical machine, each functioning as if it had its own private box. Other types of virtualization may be employed in other embodiments, such as networks (eg, via software defined networking) or functions (eg, via network function virtualization).

Accordingly, one or more of the computing devices 200 described herein may be embodied as, or form part of, one or more cloud-based systems. In cloud-based embodiments, a cloud-based system can, for example, execute multiple instructions on demand, execute instructions only when prompted by a specific activity/triggers, and consume computing resources when not in use. It can be implemented as a non-server-ambiguous computing solution. That is, the system may execute various virtual functions (e.g., lambda functions, Azure functions, Google cloud functions, and/or other suitable virtual functions) corresponding to the functionality of the system described herein. may be embodied as a virtual computing environment that resides “on” a computing system (e.g., a distributed network of devices) that obtains the information. For example, when an event occurs (e.g., data is transferred to a system for processing), the virtual computing environment may communicate (e.g., via a request to the virtual computing environment's API) that The API may route requests to the correct virtual function (eg, a particular server-ambiguous computing resource) based on a set of rules. Therefore, if a request for transmission of data is made by a user (e.g., via an appropriate user interface to the system), the appropriate virtual function will be run to perform the action before deleting the instance of the virtual function. can be done.

Referring now to FIG. 3, in use, a system or device may perform a method 300 for detecting anomalies in data provided by one or more customers. In some embodiments, the system is embodied as a contact center system (e.g., contact center system 100 of FIG. 1) and/or a computing device (e.g., computing device 200 of FIG. 2) or systems/devices thereof. Please understand that it is okay to do so. Further, in some embodiments, the system may be embodied as or otherwise include a set of tools to assist in operational monitoring, management, and troubleshooting of various platforms. . In one example, the system may be embodied as or otherwise include a suite of tools provided by Genesys Workbench (WB) 9.2 or any subsequent release(s) thereof. In particular, the system may incorporate various features, such as workbench anomaly detection (AD) functionality. Finally, certain blocks of method 300 are illustrated by way of example; such blocks may be combined in whole or in part, depending on the particular embodiment, unless stated to the contrary. It is to be understood that the information may be divided, added to, removed, and/or rearranged.

The example method 300 begins at block 312 where the system receives metric data. In some embodiments, the metric data may be provided from a source external to the system and/or remote, and the system may be communicatively coupled to the source to receive metric data from the source. . In any case, in the exemplary embodiment, the metric data represents time-series-based observations for particular customer metrics, and the selection and/or designation of the metrics is based on the unique needs of the particular customer. and/or can be adjusted accordingly. Receiving metric data at block 312 by the system may include or otherwise be associated with capturing metric data from a source (eg, CPU, RAM, disk, network).

At block 314 of the example method 300, the system defines parameters characterizing one or more spheres based on the metric data. Further details regarding the definition of these parameters are described below with reference to FIG. 4 (ie, block 414). As is clear from the foregoing description, each of the one or more spheres captures several time-series-based observations from the metric data for a particular customer metric such that the observations are located within the sphere. It is configured as follows.

At block 316 of example method 300, the system generates one or more spheres based on the parameters defined at block 314. Further details regarding the generation of spheres are explained below with reference to FIG. In the exemplary embodiment, to implement block 316, the system implements blocks 318 and 320. At block 318, the system determines coverage of the metric data within one or more spheres. At block 320, the system dynamically generates a plurality of spheres with varying radii based on time-series-based observations from metric data regarding a particular customer metric. In some embodiments, blocks 318 and 320 may be combined into a single block. In one example, determining coverage at block 318 may be combined with dynamic generation of spheres at block 320.

At block 322 of example method 300, the system saves model parameters (eg, parameters related to sphere generation at block 316). In some embodiments, execution of block 322 may represent or otherwise be associated with the complete creation of an INS model.

At block 324 of the example method 300, the system detects one or more anomalies in the metric data based on the sphere generated at block 316 and/or the model parameters saved at block 322. In some embodiments, execution of block 324 may represent anomaly detection activities performed subsequent to, or otherwise associated with, the creation of the INS model.

Although blocks 312-324 are described as relatively serial, it should be understood that the various blocks of method 300 may be performed in parallel in some embodiments.

Referring now to FIG. 4, in use, a system or device may perform a method 400 for detecting anomalies in data provided by one or more customers. Method 400 may be similar to method 300, and some blocks of method 400 may provide further details with respect to corresponding blocks of method 300, as alluded to above. In some embodiments, the system is embodied as a contact center system (e.g., contact center system 100 of FIG. 1) and/or a computing device (e.g., computing device 200 of FIG. 2) or systems/devices thereof. Please understand that it is okay to do so. Certain blocks of method 400 are illustrated by way of example; such blocks may be combined or combined in whole or in part, depending on the particular embodiment, unless stated to the contrary. It is to be understood that they may be divided, added or removed, and/or rearranged.

The example method 400 begins at block 402 where the system receives metric data. It should be appreciated that block 402 corresponds to block 302 of method 300 in at least some embodiments. In the example embodiment, to implement block 402, the system implements block 404. At block 404, the system retrieves or retrieves metric data from a source (eg, a customer platform). However, it should be understood that in some embodiments block 404 may be omitted.

At block 406 of the example method 400, the system initializes an anomaly detection model (INS model). In some embodiments, block 406 may be embodied as, or otherwise include, an input to an INS model block where the metric data received at block 402 is provided to the INS model. good. Additionally, in some embodiments, block 406 may be incorporated into block 402.

At block 408 of the example method 400, the system standardizes one or more features of the INS model. To do so, in the exemplary embodiment, the system implements blocks 410 and 412. At block 410, the system identifies one or more features of interest about the metric data received at block 402. These features, in at least some embodiments, include mathematical parameters for analyzing metric data (e.g., statistics, derivatives, weighted averages, etc.), mathematical parameters for determining a particular distribution of metric data, etc. parameters and/or mathematical parameters for identifying one or more outliers included in the metric data. At block 412, the system normalizes the features identified at block 410 based on one or more reference frames. In some embodiments, at block 412, the system establishes one or more frames of reference for evaluating the features identified at block 410.

At block 414 of the example method 400, the system defines parameters characterizing one or more spheres based on the metric data. It should be appreciated that in at least some embodiments, block 414 corresponds to block 304 of method 300. Furthermore, it should be appreciated that, in at least some embodiments, performance of block 414 by the system serves as an activity prior to subsequent generation of one or more spheres. In the exemplary embodiment, to perform block 414, the system performs blocks 416, 418, 424, 426, 428, 430, 432. Each of these blocks will be described below.

At block 416 of the example method 400, the system obtains or develops a distance matrix for the metric data received at block 402. In some embodiments, block 416 may be incorporated into block 410. In either case, the distance matrix obtained at block 416 allows the system to determine distances between observations/data points included in the metric data.

At block 418 of the example method 400, based on the distance matrix obtained at block 416, the system determines a nearest neighbor distance value for each observation/data point in the metric data. In the exemplary embodiment, to implement block 418, the system implements blocks 420 and 422. At block 420, the system determines the average nearest neighbor distance for all observations/data points in the metric data. At block 422, the system determines the maximum bound of nearest neighbor distance values according to the Tukey test. In some embodiments, the system may perform blocks 420 and 422 in parallel to each other.

At block 424 of the example method 400, the system defines radius increments for generating one or more spheres. As will be apparent from the discussion below, in at least some embodiments, radius increments are used in combination with the minimum sphere radius described below to generate one or more new spheres after the generation of the first/initial sphere. can be generated. Additionally, one or more new spheres generated using the radius increments may have varying radii due, at least in part, to variations in the radius increments and the minimum sphere radius over the course of performing method 400. In some embodiments, the definition of the radius increment at block 424 is based on the average determined by the system at block 420.

At block 426 of the example method 400, the system defines a minimum sphere radius for generation of at least one sphere. A minimum sphere radius may be used, at least in some embodiments, to generate the first/initial sphere. In some embodiments, the definition of the minimum sphere radius at block 426 is based on the maximum limit determined by the system at block 422. Further, in some embodiments, the system may perform blocks 424 and 426 in parallel to each other.

At block 428 of the example method 400, the system determines a density for the generation of at least one sphere. In some embodiments, the density corresponds to the number of observations/data points of metric data that fall inside the first/initial sphere and are captured by the first/initial sphere, or otherwise That is how it is realized. The density of a sphere, in at least some embodiments, may be determined by the concentration of observations/data points in a particular region, or may be embodied as a concentration of observations/data points in a particular region. . Additionally, in some embodiments, the determination of sphere density at block 428 is based on the distance matrix obtained by the system at block 416 and the minimum sphere radius defined by the system at block 426.

At block 430 of example method 400, the system applies a density filter to the sphere density determination made at block 428. In some embodiments, a density filter applied by the system at block 430 is applied from the metric data so that outliers or anomalous/unusual observations do not affect the definition of the coverage limits described below. Filter out outliers or unusual/unusual observations.

At block 432 of the example method 400, the system defines a coverage limit that indicates the maximum number of observations/data points covered by the sphere. In the exemplary embodiment, the coverage limits defined by the system at block 432 are based at least in part on the filtered metric data from block 430.

At block 434 of example method 400, the system generates one or more spheres based on the parameters defined at block 414. It should be appreciated that in at least some embodiments, block 434 corresponds to block 306 of method 300.

Although blocks 402-434 are described as relatively serial, it should be understood that the various blocks of method 400 may be performed in parallel in some embodiments.

Referring now to FIG. 5, in use, to perform block 434 of method 400, a system or device may perform method 500. Method 500 may be similar to block 306 of method 300, at least in some embodiments. In some embodiments, the system is embodied as a contact center system (e.g., contact center system 100 of FIG. 1) and/or a computing device (e.g., computing device 200 of FIG. 2) or systems/devices thereof. Please understand that it is okay to do so. Certain blocks of method 500 are illustrated by way of example; such blocks may be combined or combined in whole or in part, depending on the particular embodiment, unless stated to the contrary. It is to be understood that they may be divided, added or removed, and/or rearranged.

The example method 500 begins at block 502 where the system detects one or more spheres that have been previously generated. It should be appreciated that in some cases (eg, during first/initial sphere generation), no spheres may be detected at block 502. Therefore, in these cases, block 502 may optionally be omitted from the method.

At block 504 of the example method 500, the system determines a density for the generation of at least one sphere. In some embodiments, the density corresponds to the number of metric data observations/data points that fall inside the first/initial sphere and are captured by the first/initial sphere, or otherwise That is how it is realized. In other embodiments, the density of the metric data observations/data points that fall within and are captured by the first/initial sphere and one or more spheres closest to the first/initial sphere. corresponds to a number or is embodied in many ways. In the exemplary embodiment, to implement block 504, the system implements blocks 506, 508, 510, and 512.

At block 506 of the example method 500, the system determines the density based on the minimum sphere radius defined at block 426 of the method 400. At block 508 of example method 500, the system determines density based on the closest detected sphere (eg, the sphere detected at block 502). It should be appreciated that in some cases (eg, during first/initial sphere generation), the closest sphere may not be detected and the system may not perform block 508. Furthermore, in other cases (e.g., when one or more closest spheres are generated subsequent to the generation of the first/initial sphere), the determination of density at block 504 is defined at block 426 of method 400. It should be appreciated that it may be based on both the minimum sphere radius detected and the closest detected sphere (eg, from block 502). Therefore, in these cases blocks 506 and 508 may be combined into a single block.

At block 510 of the example method 500, the system determines a location corresponding to a maximum concentration of metric data based at least in part on the minimum sphere radius defined at block 426. In some cases, the position determined by the system at block 510 may also be based on the nearest detected sphere. At block 512, the system generates at least one sphere such that the center of the sphere is located at the location determined at block 510. The at least one sphere generated by the system at block 512 may correspond to the first/initial sphere in at least some cases. In other cases, the at least one sphere generated by the system in block 512 may correspond to a sphere generated after the first/initial sphere. In those cases, the system determines the maximum concentration of metric data based on (i) the minimum sphere radius defined in block 426 and the distance between the first/initial sphere and the at least one nearest neighbor sphere; (i.e., at block 510); and (ii) generate at least one new sphere such that the center of the at least one new sphere is located at the other position (i.e., at block 510). 512).

At block 514 of the example method 500, the system compares the coverage of metric data provided by the new or most recently generated sphere to the coverage of metric data provided by one or more reference spheres. In one example, the reference sphere includes a first/initial sphere. In another example, the reference sphere(s) include a first/initial sphere and at least one nearest neighbor sphere generated subsequently to the first sphere. Of course, if the sphere generated by the system in block 512 corresponds to the first/initial sphere, then execution of block 514 may be omitted, at least in some embodiments.

At block 516 of the example method 500, the system selects the sphere (i.e., among the spheres compared at block 514) that provides the greatest coverage of metric data for generation of another new sphere. It should be appreciated that in at least some embodiments, execution of block 516 may be omitted if the sphere generated by the system at block 512 corresponds to the first/initial sphere.

At block 518 of the example method 500, the system determines whether the coverage limit defined at block 432 of the method 400 has been reached.

At block 520 of the example method 500, in response to the determination at block 518 that the coverage limit has been reached, the system saves the anomaly detection model (i.e., the INS model).

At block 522 of the example method 500, the system finishes training the model based on the metric data.

At block 524 of the example method 400, in response to the determination at block 518 that the coverage limit has not been reached, the system creates at least one new sphere based on the radius increment defined at block 424 of the method 500. Increment radius for generation.

At block 526 of the example method 500, the system determines whether at least one new sphere (the radius of which was incremented at block 524) provides coverage of metric data not previously provided.

At block 528 of the example method 500, in response to the determination at block 526 that the at least one new sphere provides coverage of metric data not previously provided, the system performs a process for generating a next sphere. The minimum sphere radius (eg, the minimum sphere radius defined in block 426 of method 400) and position (eg, the position described above with reference to block 512) corresponding to the center are updated.

At block 530 of the example method 500, in response to the determination at block 526 that the at least one new sphere does not provide coverage of metric data not previously provided, the system associates the at least one new sphere with filter out the metric data.

Although blocks 502-530 are described as being relatively serial, it should be understood that the various blocks of method 500 may be performed in parallel in some embodiments.

A number of unique features and/or advantages may be associated with the execution and implementation of the example INS model by the system. In one aspect, the model provides automatic parameter tuning across a wide range of different metrics because the model can be trained without regard to specific customer metrics. In another aspect, since the model does not rely on a predetermined number of spheres to be generated for a particular customer metric, spheres may be generated according to each iteration of the model, which means that at least some In some cases, higher accuracy and/or precision may be provided. In yet another aspect, the model avoids limitations associated with positioning spheres according to random probability distributions because the positions of spheres generated by the model are determined based on high density/high concentration regions. In yet another aspect, by filtering/removing metric data points already covered by previous iterations, the computational complexity of the model is reduced compared to other configurations. In a further aspect, the dynamic radius calculations performed during each model iteration, and the spheres with variable radii that are generated based on those calculations, use fewer spheres than may be required by other configurations. , enabling expanded data coverage. In yet another aspect, the model uses data points outside of existing spheres to generate new spheres, integrates the spheres with each other, and/or the model without the need for historical data regarding specific customer metrics. Mutations can be captured. In an additional aspect, because the model ignores data points covered by previous iterations, the model may achieve a degree of accuracy and/or precision not achieved by other configurations. Furthermore, it should be appreciated that the reduced computational complexity of the model may minimize the storage space (eg, in memory) required to store model data. Finally, the model can provide improved simplicity for calculation of anomaly scores based on distance to nearest neighbor sphere.

Referring now to FIG. 6, a set 600 of metric data points/observations is shown after feature selection and before data analysis and generation of spheres based on the INS model. In an exemplary embodiment, the representation of the metric data points shown in FIG. 6 is associated with a standardized representation of model features (e.g., the representation after execution of block 408 by the system) or otherwise handle. Additionally, in the illustrative example, the data point set 600 includes approximately 288 points collected over one day. Of course, it should be appreciated that in other examples, collection 600 can include any other suitable number of data points collected over any other suitable time period.

Referring now to FIG. 7, based on a set of data points/observations 600, at least one iteration of an INS model by the system (e.g., by methods 300, 400, 500) has a center 702 and a radius 704. A sphere 700 is generated. In the illustrative example, center 702 is located at the maximum concentration/density of data points within sphere 700 with the minimum sphere radius. Further, in the illustrative example, sphere 700 provides approximately 25% coverage of the data points within set 600. In some embodiments, larger spheres may exhibit a dominant behavior with multiple single behaviors.

Referring now to FIG. 8, based on the set of data points/observations 600, multiple iterations of the INS model by the system (e.g., by the methods 300, 400, 500) create another model having a center 802 and a radius 804. A sphere 800 is generated. In the illustrative example, radius 804 is different from and smaller than radius 704, and spheres 700, 800 are spaced apart from each other. Additionally, in the illustrative example, center 802 is located at the maximum concentration/density of data points within sphere 800. Finally, in the illustrative example, spheres 700, 800 together provide coverage of approximately 47% of the data points in set 600.

Referring now to FIG. 9, based on the set of data points/observations 600, multiple iterations of the INS model by the system (e.g., by methods 300, 400, 500) create another model having a center 902 and a radius 904. A sphere 900 is generated. In the illustrative example, radius 904 is different from and larger than radius 804, and spheres 700, 800, 900 are spaced apart from each other. Additionally, in the illustrative example, center 902 is located at the greatest concentration/density of data points within sphere 900. Finally, in the illustrative example, spheres 700, 800, 900 together provide approximately 72% coverage of the data points in set 600.

Referring now to FIG. 10, based on the set of data points/observations 600,
Execution of a comparison model different from the INS model (e.g., by a different method than the example methods 300, 400, 500) produces a set 1000 of spheres each having the same radius. In a comparative example, set 1000 includes 21 balls.

Referring now to FIG. 11, based on a set of data points/observations 600, multiple iterations of the INS model by the system (e.g., by methods 300, 400, 500) generate a set of spheres 1100 with variable radii. generate. In the illustrative example, set 1100 includes seven spheres (ie, spheres 700, 800, 900, 1102, 1104, 1106, 1108). In at least some cases, set 1100 provides equal or better coverage of set 600 than set 1000, using fewer spheres.

Referring now to FIG. 12, a performance evaluation 1200 shows the performance of the INS model compared to other algorithms based on various data sets. The models/algorithms represented are: (i) 1-class SVM 1202, (ii) Isolated Forest (iForest) 1204, (iii) Local Outlier Factors 1206, (iv) Isolated Nearest Neighbor Ensemble (iNNE) 1208, (v) Constant (vi) an isolated nearest sphere (INSS) 1210 with a sphere radius; and (vi) an isolated nearest sphere 1212 (corresponding to the INS model) with a variable sphere radius. The datasets include datasets 1216, 1218, 1220, 1222, 1224, 1226, 1228, 1230 with introduced anomalies. Evaluation 1200 shows the characteristics of different anomaly detection models/algorithms on two-dimensional datasets. A dataset may, in at least some embodiments, include one or two modes (regions of high density) to demonstrate the ability of the model/algorithm to deal with multimodal data.

For each data set 1216, 1218, 1220, 1222, 1224, 1226, 1228, 1230, one percent of the samples are generated as random noise and may be considered as outliers. The data points in these datasets are (a) circular (i.e., corresponding to normal samples detected as normal), (b) starting (i.e., corresponding to outliers detected as outliers), ( c) upward-pointing triangles (i.e., corresponding to outliers detected as normal samples); and (d) downward-pointing triangles (i.e., corresponding to normal samples detected as outliers).

Referring now to FIG. 13, based on the set of data points/observations 1300,
Execution of a comparison model different from the INS model (iNNE) (eg, by a different method than the example methods 300, 400, 500) produces a set of spheres 1302. In a comparative example, set 1302 may include 320 balls. Additionally, in the comparative example, set of balls 1302 may be associated with an F1 score of 59.3%.

Referring now to FIG. 14, based on the set of data points/observations 1300, multiple iterations of the INS model by the system (eg, by the methods 300, 400, 500) generate a set of spheres 1400. In an illustrative example, set 1400 may include 99 balls. Additionally, in the illustrative example, set of balls 1400 may be associated with an F1 score of 92.0%.

Referring now to FIG. 15, based on the set of data points/observations 1500,
Execution of a comparison model different from the INS model (iNNE) (eg, by a different method than the example methods 300, 400, 500) produces a set of spheres 1502. In a comparative example, set 1502 may include 320 balls. Additionally, in the comparative example, set of balls 1502 may be associated with an F1 score of 78.9%.

Referring now to FIG. 16, based on a set of data points/observations 1500, multiple iterations of an INS model by the system (eg, by methods 300, 400, 500) generate a set of spheres 1600. In an illustrative example, set 1600 may include 83 balls. Additionally, in the illustrative example, set of balls 1600 may be associated with an F1 score of 95.5%.

Referring now to FIGS. 17 and 18, a set of comparison graphs 1700 are associated with executions of comparison models that are different from the INS model, and a set of graphs 1800 are associated with executions of the INS model.

In some embodiments, a method for automatically detecting anomalies in a continuously monitored component comprises:
- Continuously monitoring data points from a performance counter while the component is operating includes receiving data points included in a time series generated by the component by a processor of the computing device. the data points are performance counter data points, and the data points are not labeled as normal or abnormal before being processed;
- detecting an anomaly in a time series when there is no labeled data that defines abnormal data and no labeled data that defines normal data;
- for aggregating anomalous events that occur for a single data point in multiple processing paths by combining them into a single event that carries all identifiers of the detected processing paths; post-processing of an abnormal event that has occurred, where each processing path identifier corresponds to a respective type of abnormality;
- provide information regarding whether the component is operating properly or malfunctioning, and to notify the owner or operator of the component of abnormal behavior when it occurs; may include enabling and
- Detecting an anomaly in a time series comprises detecting the score of an anomaly of one sample along with the scores of its neighbors according to the Isolation Nearest Spheres algorithm.

Claims (20)

A system for detecting anomalies in metric data provided by one or more customers, the system comprising:
at least one processor;
at least one memory containing a plurality of stored instructions, the instructions, upon execution by the at least one processor, providing the system with:
receive metric data representing multiple time series-based observations for a particular customer metric;
define a plurality of parameters for characterizing one or more spheres, each configured to capture a number of time-series-based observations for the particular customer metric based on the metric data; ,
a memory that generates the one or more spheres based on the plurality of parameters, causes the coverage of the metric data within the one or more spheres to be determined, and detects one or more anomalies in the metric data. and,
Generating the one or more spheres based on the plurality of parameters includes generating a plurality of spheres, each having a radius that varies based on the plurality of time series-based observations for the particular customer metric. A system that includes dynamic generation. Defining the plurality of parameters based on the metric data comprises:
defining a minimum radius for generating at least one sphere;
defining radius increments for generating one or more new spheres each having a varying radius;
and defining a coverage limit indicating a maximum number of metric data points covered by the generated sphere. 3. The system of claim 2, wherein generating the one or more spheres based on the plurality of parameters includes determining a location corresponding to a maximum concentration of metric data based on the minimum radius. Generating the one or more spheres based on the plurality of parameters comprises:
determining whether the coverage limit has been reached;
and, in response to the determination that the coverage limit has not been reached, incrementing a radius for generation of at least one new sphere based on the radius increment. Generating the one or more spheres based on the plurality of parameters comprises:
determining whether the at least one new sphere provides coverage of the metric data not previously provided;
filtering out metric data already covered by a previous sphere in response to a determination that the at least one new sphere does not provide coverage of the metric data not previously provided. 4. The system described in 4. Generating the one or more spheres based on the plurality of parameters comprises:
updating the minimum radius in response to a determination that the at least one new sphere provides coverage of the metric data not previously provided;
and updating the position in response to the determination that the at least one new sphere provides coverage of the metric data that was not previously provided. Generating the one or more spheres based on the plurality of parameters comprises:
determining another location corresponding to the maximum concentration of metric data based on the minimum radius of the at least one sphere and a distance between the at least one sphere and at least one nearest neighbor sphere; ,
4. The system of claim 3, comprising: generating at least one new sphere such that the center of the at least one new sphere is positioned at the other location. Generating the one or more spheres based on the plurality of parameters comprises:
comparing the coverage of the metric data provided by the at least one sphere to the coverage of the metric data provided by the at least one nearest sphere or the at least one new sphere;
and selecting a sphere that provides maximum coverage of the metric data based on the comparison for generation of another new sphere. Defining the plurality of parameters based on the metric data comprises:
filtering out outliers from the metric data;
and defining the coverage limit based at least in part on the filtered metric data. one or more non-transitory machine-readable storage media containing a plurality of stored instructions, the instructions being responsive to execution by at least one processor to cause the system to:
receive metric data representing multiple time series-based observations for a particular customer metric;
define a plurality of parameters for characterizing one or more spheres, each configured to capture a number of time-series-based observations for the particular customer metric based on the metric data; ,
a memory that generates the one or more spheres based on the plurality of parameters, causes the coverage of the metric data within the one or more spheres to be determined, and detects one or more anomalies in the metric data. and,
Generating the one or more spheres based on the plurality of parameters includes generating a plurality of spheres, each having a radius that varies based on the plurality of time series-based observations for the particular customer metric. one or more non-transitory machine-readable storage media, including dynamically generating one or more non-transitory machine-readable storage media; Defining the plurality of parameters based on the metric data comprises:
defining a minimum radius for generating at least one sphere;
defining radius increments for generating one or more new spheres each having a varying radius;
and defining a coverage limit indicating a maximum number of metric data points covered by the generated sphere. The one or more of claim 11, wherein generating the one or more spheres based on the plurality of parameters includes determining a location corresponding to a maximum concentration of metric data based on the minimum radius. non-transitory machine-readable storage medium. Generating the one or more spheres based on the plurality of parameters comprises:
determining whether the coverage limit has been reached;
and, in response to the determination that the coverage limit has not been reached, incrementing a radius for generation of at least one new sphere based on the radius increment. Non-transitory machine-readable storage medium. Generating the one or more spheres based on the plurality of parameters comprises:
determining whether the at least one new sphere provides coverage of the metric data not previously provided;
filtering out metric data already covered by a previous sphere in response to a determination that the at least one new sphere does not provide coverage of the metric data not previously provided. 14. One or more non-transitory machine-readable storage media as described in 13. Generating the one or more spheres based on the plurality of parameters comprises:
updating the minimum radius in response to a determination that the at least one new sphere provides coverage of the metric data not previously provided;
updating the position in response to the determination that the at least one new sphere provides coverage of the metric data not previously provided. Non-transitory machine-readable storage medium. Defining the plurality of parameters based on the metric data comprises:
filtering out outliers from the metric data;
and defining the coverage limit based at least in part on the filtered metric data. A method for detecting anomalies in metric data provided by one or more customers, the method comprising:
receiving, by a contact center system or computing device, metric data indicating a plurality of time-series-based observations for a particular customer metric;
characterizing one or more spheres, each sphere configured to capture a number of time-series-based observations for the particular customer metric, by the contact center system or the computing device based on the metric data; By defining multiple parameters for
generating the one or more spheres based on the plurality of parameters by the contact center system or the computing device to determine coverage of the metric data within the one or more spheres; detecting one or more anomalies;
Generating the one or more spheres based on the plurality of parameters varies by the contact center system or the computing device based on the plurality of time series-based observations for the particular customer metric. A method comprising dynamically generating a plurality of spheres each having a radius. Defining the plurality of parameters based on the metric data comprises:
defining, by the contact center system or the computing device, a minimum radius for the generation of at least one sphere;
defining, by the contact center system or the computing device, a radius increment for generating one or more new spheres with varying radii;
18. The method of claim 17, comprising: defining, by the contact center system or the computing device, a coverage limit indicating a maximum number of metric data points covered by the generated sphere. Generating the one or more spheres based on the plurality of parameters includes determining, by the contact center system or the computing device, a location corresponding to a maximum concentration of metric data based on the minimum radius. 19. The method of claim 18. Generating the one or more spheres based on the plurality of parameters comprises:
determining, by the contact center system or the computing device, whether the coverage limit has been reached;
incrementing, by the contact center system or the computing device, a radius for generation of at least one new sphere based on the radius increment in response to the determination that the coverage limit has not been reached. The method according to item 19.

Images